Implement Redshift Proof System

[nkaskov]

Duplicates corresponding issue in Zero-Knowledge proofs repository.

[mimoo]

BTW I was wondering why redshift and why not verify the plonk proof directly in ethereum? Not sure if I understand this correctly, but it looks like it is possible

[nemothenoone]

@mimoo It is technically possible, yes, but the direct verification cost for a circuit used for Mina's state proof turns out to be overwhelming. It definitely exceeds 5m gas. Probably goes out of the 10m threshold as well. So we had to wrap it with the proof system with a cheaper verification.

[mimoo]

interesting, how would that compare with plonky2 which seems to use the same kind of techniques?

[nemothenoone]

@mimoo When this project was started, no such thing as plonky2 existed. Even if it did, I highly doubt, we would've picked it because it cannot be considered as a general-purpose proof system.

Plonky2 is a proof system done for the only purpose - to dominate synthetic benchmark results table. It targets recursive verification case done with circuits of a very particular kind (no signature or finite field elements longer than 64 bit can be proved efficiently with it - i.e. no efficient Mina's proof systems curves processing is possible with it) for a very particular hardware (arm64) Even a curve which was picked for plonky2 (for the by-default usage) was picked with the only purpose in mind - to show fastest benchmark results with a very particular hardware (https://moderncrypto.org/mail-archive/curves/2014/000322.html).

What we are building is a general-purpose proof system that can be applied to different use cases. It does uses PLONK with custom gates and LPC commitment scheme as well, yes, but there are differences in the arithmetization part, public input enforcement method, and lookup approach. We will publish a spec in a couple of weeks.

I'm also thinking that eventually all those PLONK-ish proof systems will result into some configurable proof system with substitutable components. At least we target the creation of such one within the cryptography suite of ours.

[mimoo]

Interesting, thanks for the thorough answer, I found some of these details here as well :)

[nemothenoone]

Done with: NilFoundation/crypto3-zk@5a60299